CVEs published April 13, 2022
51 CVEs were published on April 13, 2022: 5 critical, 10 high. 2 are now in CISA KEV.
- Published
- 51
- Critical
- 5
- High
- 10
- Medium
- 6
- Low
- 1
- Unrated
- 29
- Now in CISA KEV
- 2
- Fix available
- 22
Most affected products
- VMware Workspace ONE Access, Identity Manager and vRealize…
- 5
- causefx/organizr
- 4
- Autodesk Trueview
- 3
- Citirx Citrix SD-WAN
- 2
- flipped-aurora gin-vue-admin
- 2
- VMware Workspace ONE Access
- 2
- vyperlang vyper · vyper
- 2
- Yooslider Yoo Slider – Image Slider & Video Slider
- 2
- Apache Software Foundation Apache Superset · apache-superset
- 1
- Citrix StoreFront
- 1
Critical 5
- CVE-2022-24816Improper Control of Generation of Code in jai-extgeosolutions-it jai-ext · it.geosolutions.jaiext.jiffle:… +1
- CVE-2022-1347Stored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in causefx/organizrcausefx/organizr
- CVE-2022-1345Stored XSS viva .svg file upload in causefx/organizrcausefx/organizr
- CVE-2022-1346Multiple Stored XSS in causefx/organizrcausefx/organizr
- CVE-2022-1344Stored XSS due to no sanitization in the filename in causefx/organizrcausefx/organizr
High 10
- CVE-2022-24847Improper Input Validation in GeoServergeoserver · org.geoserver:gs-main
- CVE-2022-24845Integer bounds error in Vypervyperlang vyper · vyper
- CVE-2022-24843Path Traversal in github.com/flipped-aurora/gin-vue-adminflipped-aurora gin-vue-admin
- CVE-2022-24844SQL Injection in github.com/flipped-aurora/gin-vue-adminflipped-aurora gin-vue-admin
- CVE-2022-24828Missing input validation can lead to command execution in composercomposer · composer/composer
- CVE-2022-24818Unchecked JNDI lookups in GeoToolsgeotools
- CVE-2022-24788Buffer overflow in Vypervyperlang vyper · vyper
- CVE-2022-1339SQL injection in ElementController.php in pimcore/pimcorepimcore/pimcore
- CVE-2015-20107In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file.
- CVE-2022-22960VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissioVMware Workspace ONE Access, Identity Manager and vRealize…
Medium, low and unrated 36
- CVE-2021-43154Cross Site Scripting (XSS) vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.ph
- CVE-2022-27479SQL injection vulnerability in chart data APIApache Software Foundation Apache Superset · apache-superset
- CVE-2022-0023PAN-OS: Denial-of-Service (DoS) Vulnerability in DNS ProxyPalo Alto Networks PAN-OS · Palo Alto Networks Prisma Access
- CVE-2021-41119DoS vulnerabiliity in wire-server json parserwireapp wire-server
- CVE-2022-27524An out-of-bounds read can be exploited in Autodesk TrueView 2022 may lead to an exposure of sensitive information or a crash through using aAutodesk Trueview
- CVE-2022-27523A buffer over-read can be exploited in Autodesk TrueView 2022 may lead to an exposure of sensitive information or a crash through using a maAutodesk Trueview
- CVE-2022-27505Reflected cross site scripting (XSS)Citirx Citrix SD-WAN
- CVE-2022-27506Hard-coded credentials allow administrators to access the shell via the SD-WAN CLICitirx Citrix SD-WAN
- CVE-2022-1332Restricted custom admin role can bypass the restrictions and view the server logs and server config.json file contentsMattermost · github.com/mattermost/mattermost-server/v6 +2
- CVE-2022-1333A specifically drafted Playbook could trigger large amount of webhook requests leading to Denial of ServiceMattermost Playbooks
- CVE-2022-1337OOM DoS in Mattermost image proxyMattermost · github.com/mattermost/mattermost-server +2
- CVE-2022-22955VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework.VMware Workspace ONE Access
- CVE-2022-22958VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVVMware Workspace ONE Access, Identity Manager and vRealize…
- CVE-2022-22961VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excesVMware Workspace ONE Access, Identity Manager and vRealize…
- CVE-2022-22959VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability.VMware Workspace ONE Access, Identity Manager and vRealize…
- CVE-2022-27503Cross-site Scripting (XSS) vulnerability in Citrix StoreFront affects version 1912 before CU5 and version 3.12 before CU9Citrix StoreFront
- CVE-2022-27846WordPress Yoo Slider plugin <= 2.0.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Slider Creation / ModificationYooslider Yoo Slider – Image Slider & Video Slider
- CVE-2022-27847WordPress Yoo Slider plugin <= 2.0.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Template ImportYooslider Yoo Slider – Image Slider & Video Slider
- CVE-2022-1280A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux kernel due to a race problem.kernel
- CVE-2021-42136A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows remote attackers to
- CVE-2021-46167An access control issue in the authentication module of wizplat PD065 v1.19 allows attackers to access sensitive data and cause a Denial of
- CVE-2022-28052Directory Traversal vulnerability in file cn/roothub/store/FileSystemStorageService in function store in Roothub 2.6.0 allows remote attacke
- CVE-2022-26144An XSS issue was discovered in MantisBT before 2.25.3.mantisbt/mantisbt
- CVE-2022-27256A PHP Local File inclusion vulnerability in the Redbasic theme for Hubzilla before version 7.2 allows remote attackers to include arbitrary
- CVE-2022-26643An issue in EasyIO CPT Graphics v0.8 allows attackers to discover valid users in the application.
- CVE-2021-43741CMSimple 5.4 is vulnerable to Directory Traversal.
- CVE-2021-43742CMSimple 5.4 is vulnerable to Cross Site Scripting (XSS) via the file upload feature.
- CVE-2022-24308Automox Agent prior to version 37 on Windows and Linux and Version 36 on OSX could allow for a non privileged user to obtain sensitive infor
- CVE-2020-29653Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter.froxlor/froxlor
- CVE-2022-27475Cross site scripting (XSS) vulnerability in tramyardg hotel-mgmt-system, allows attackers to execute arbitrary code when when /admin.php is
- CVE-2022-29156drivers/infiniband/ulp/rtrs/rtrs-clt.c in the Linux kernel before 5.16.12 has a double free related to rtrs_clt_dev_release.
- CVE-2022-22279A post-authentication arbitrary file read vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versionSonicWall SRA/SMA100
- CVE-2022-22956VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework.VMware Workspace ONE Access
- CVE-2022-22957VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVVMware Workspace ONE Access, Identity Manager and vRealize…
- CVE-2022-25795A Memory Corruption Vulnerability in Autodesk TrueView 2022 and 2021 may lead to remote code execution through maliciously crafted DWG filesRevit, Navisworks, Autodesk® Advance Steel, AutoCAD®, AutoC…
- CVE-2022-25797A maliciously crafted PDF file in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to dereference for a write beyond the allocated bufferAutodesk Trueview